@blamejs/pki 0.8.56 → 0.8.58

package/lib/inspect.js

@@ -1063,7 +1063,7 @@ function _looksParsedOcspResp(o) {
   var st = o.responseStatus;
   if (!st || typeof st !== "object" || typeof st.code !== "number" || typeof st.name !== "string") return false;
   var br = o.basicResponse;
-  /** @internal A response with no basic response is a status-only answer the report handles, but one that
+  /** @internal A response with no basic response is an envelope-only answer the report handles, but one that
    *  HAS a basic response has to carry the answers the report walks: a responderID and a responses list whose
    *  entries name a CertID and a status. */
   if (br === null || br === undefined) return true;

package/lib/lint.js

@@ -5087,6 +5087,51 @@ var RFC5652_CMS_RULES = [
       return (encap && encap.eContent) ? null : true;
     },
   },
+  {
+    id: "lint/rfc5652/other-revocation-format-not-read", severity: "notice", source: "rfc5652",
+    citation: "RFC 5940 4",
+    /** @internal The carriage is sec. 10.2.1's `other` arm, which is why the row sits in this
+     * profile; the document that registers the formats is the citation. RFC 5940 sec. 2 registers
+     * `id-ri-ocsp-response` for an OCSP response carried in the `crls` field and sec. 4 registers
+     * `id-ri-scvp` for an SCVP request-response pair. The parse reads the first and leaves the second
+     * as raw bytes, because acting on it needs an SCVP schema this build does not carry. An
+     * unregistered format is opaque for the same reason. Neither is a parse fault: sec. 10.2.1's ANY
+     * DEFINED BY is an extension point, so refusing an unknown format would refuse a future
+     * registered one. The finding tells an operator that revocation information present in the
+     * message was not read, which a reader counting on it needs to know. A notice: the message is
+     * conformant and the entry may be irrelevant to the certificates it travels with.
+     * An id-ri-ocsp-response entry whose OCSPResponse states a responseType this build does not
+     * decode (RFC 6960 sec. 4.2.1) is reported for the same reason: the format was recognized, the
+     * revocation information still was not read, and `responseType` in the context names why. */
+    message: "a crls entry carries revocation information this build does not read, so it was not consulted",
+    /** @internal Every content type that can carry a RevocationInfoChoice: SignedData's own `crls`
+     * and the `originatorInfo.crls` that EnvelopedData, AuthenticatedData and AuthEnvelopedData
+     * share. The buckets are read by presence rather than by content type, so one predicate admits
+     * each carrier and a type that carries neither draws nothing. */
+    appliesTo: function (cms) {
+      return Array.isArray(cms.crls) || !!(cms.originatorInfo && Array.isArray(cms.originatorInfo.crls));
+    },
+    check: function (cms) {
+      var out = [];
+      var buckets = [{ where: "crls", list: cms.crls },
+        { where: "originatorInfo.crls", list: cms.originatorInfo && cms.originatorInfo.crls }];
+      buckets.forEach(function (bucket) {
+        if (!Array.isArray(bucket.list)) return;
+        bucket.list.forEach(function (entry, index) {
+          if (!entry || entry.tagClass !== "context") return;
+          var resp = entry.ocspResponse;
+          if (resp && resp.basicResponse) return;
+          var rb = resp && resp.responseBytes;
+          out.push({ context: { placement: bucket.where, index: index,
+            otherRevInfoFormat: entry.otherRevInfoFormat,
+            otherRevInfoFormatName: entry.otherRevInfoFormatName,
+            responseType: (rb && rb.responseType) || null,
+            responseTypeName: (rb && rb.responseTypeName) || null } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
 ];
 
 /** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
@@ -7141,7 +7186,9 @@ function _ingestOcsp(input) {
  * already-parsed `pki.schema.ocsp.parseResponse` object. It returns the same `LintReport` shape
  * `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
  * well-formed response produce a single `fatal` finding `lint/unparseable` carrying the strict
- * parser's own code. A non-successful response carries no BasicOCSPResponse and draws no row.
+ * parser's own code. A response with no BasicOCSPResponse to grade draws no row: a non-successful
+ * status carries none, and neither does a response carried in a CMS `crls` entry whose
+ * `responseType` this build does not decode.
  *
  * The `rfc6960` rows cover each SingleResponse's update times and their relation to producedAt,
  * an empty `certs` field, the extended revoked definition (criticality, value and placement) and
@@ -7203,8 +7250,9 @@ function ocsp(input, opts) {
     report = { findings: [ingested.fatal], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
   } else if (!ingested.response.basicResponse) {
-    /** @internal A non-successful response carries no BasicOCSPResponse, so every row is not
-     * applicable to it: the profile grades responses, and an error status is not one. */
+    /** @internal Every row is not applicable to a response with no BasicOCSPResponse: the profile
+     * grades a response body, and neither an error status nor a responseType this build does not
+     * decode produces one. */
     report = { findings: [], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: rules_.length, ne: 0 }) };
   } else {

package/lib/ocsp.js

@@ -659,6 +659,13 @@ function buildErrorResponse(status) {
  * replayed would hand a soft-failing caller the very certificate the responder refused. A replayed
  * `revoked` is therefore reported as `revoked` with `nonceMatched: false`.
  *
+ * `response` is DER `Buffer` / `Uint8Array`, a PEM `OCSP RESPONSE` string, or an unmodified
+ * `pki.schema.ocsp.parseResponse` result, which includes the record a CMS `crls` entry surfaces in
+ * `ocspResponse`. From bytes, a `responseType` this build does not decode is the parse fault
+ * `ocsp/unsupported-response-type`. A record that carries such a response, which RFC 5940 sec. 3
+ * permits a message to carry, is taken and determines nothing: the verdict is `"unknown"` with no
+ * `signatureValid`, because the body stating the certificate's status was never read.
+ *
  * @opts
  *   cert            the target certificate (parsed, DER, or PEM) -- REQUIRED.
  *   issuer          its issuer certificate (parsed, DER, or PEM) -- REQUIRED.

package/lib/oid.js

@@ -432,6 +432,13 @@ var FAMILIES = Object.assign(Object.create(null), {
     scepMessageType: 2, scepPkiStatus: 3, scepFailInfo: 4,
     scepSenderNonce: 5, scepRecipientNonce: 6, scepTransactionId: 7 } },
   scep: { base: [1, 3, 6, 1, 5, 5, 7, 24], of: { scepFailInfoText: 1 } },
+  /** @internal id-ri, the RFC 5940 revocation-information arc. Only the two leaves a reader can act
+   *  on are registered: 2 names an OCSPResponse carried in a CMS `crls` field (RFC 5940 sec. 2) and
+   *  4 names an SCVP request-response pair (sec. 4). Leaves 1 and 3 are the SCVP sub-arcs RFC 5940
+   *  does not define a CMS carriage for. The hyphenated member names are the RFC's own; `ocspResponse`
+   *  is already bound to the OCSP nonce arc's `1.3.6.1.5.5.7.48.1.4` and is read by name from the
+   *  OCSP extension-placement table, so reusing it here would redirect that table as well. */
+  idRi: { base: [1, 3, 6, 1, 5, 5, 7, 16], of: { "id-ri-ocsp-response": 2, "id-ri-scvp": 4 } },
 });
 
 var _byOid = new Map();

package/lib/schema-cms.js

@@ -34,8 +34,13 @@
  *   (sec. 5.4); `authAttrsBytes` plays the same role for the sec. 9.2 MAC input and the
  *   RFC 5083 sec. 2.2 AAD. Embedded certificates and CRLs are surfaced as raw DER +
  *   their outer tag, validated against the closed CertificateChoices /
- *   RevocationInfoChoice tag sets, so an obsolete alternative never fails the
- *   parse but an out-of-set element does. DER-only, fail-closed.
+ *   RevocationInfoChoice tag sets, so an out-of-set element fails the parse. A
+ *   certificate alternative is surfaced raw whatever it holds; a `crls` entry in the
+ *   `other [1]` arm is read as RFC 5652 sec. 10.2.1 `OtherRevocationInfoFormat`,
+ *   which names its format and, for RFC 5940 `id-ri-ocsp-response`, carries the
+ *   embedded OCSP response as a record revocation checking takes directly. An
+ *   unrecognized format stays opaque; a malformed one fails the parse. DER-only,
+ *   fail-closed.
  *
  * @card
  *   Parse DER / PEM CMS (RFC 5652 / 5083 / 9629) into structured, validated fields:
@@ -49,6 +54,9 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
 var oid = require("./oid");
+/** @internal The OCSP response schema, for the RFC 5940 `crls` arm. `schema-ocsp` requires neither
+ *  this module nor anything that reaches it, so this is an ordinary top-of-file require. */
+var ocspSchema = require("./schema-ocsp");
 var frameworkError = require("./framework-error");
 var schemaX509 = require("./schema-x509");
 var schemaCrl = require("./schema-crl");
@@ -383,6 +391,78 @@ var CRL_CHOICE_TAGS = Object.assign(Object.create(null), {
   universal: Object.create(null),
   context: Object.assign(Object.create(null), { 1: true }),
 });
+
+/** @internal RFC 5652 sec. 10.2.1's `other` arm:
+ *
+ *    OtherRevocationInfoFormat ::= SEQUENCE { otherRevInfoFormat OBJECT IDENTIFIER, otherRevInfo ANY }
+ *
+ *  Exactly two components. OpenSSL's `crypto/cms/cms_asn1.c` makes `otherRevInfo` optional, so it both
+ *  accepts and can emit an entry carrying no revocation information at all; the ASN.1 above has no
+ *  OPTIONAL and the one-element form is refused here. */
+var OTHER_REV_INFO = schema.seq([
+  schema.field("otherRevInfoFormat", schema.oidLeaf()),
+  schema.field("otherRevInfo", schema.any()),
+], {
+  assert: "implicit", implicitTag: 1, arity: { exact: 2 },
+  code: "cms/bad-other-rev-info", what: "OtherRevocationInfoFormat",
+  build: function (m) {
+    return {
+      otherRevInfoFormat: m.fields.otherRevInfoFormat.value,
+      otherRevInfoNode: m.fields.otherRevInfo.value,
+    };
+  },
+});
+var OID_ID_RI_OCSP_RESPONSE = oid.byName("id-ri-ocsp-response");
+
+/** @internal The crls element mapper, which unlike `rawChoiceElement` needs the walk's own ctx: the
+ *  `other` arm's interior is decoded under the caller's caps and budget rather than at defaults.
+ *
+ *  The universal arm is surfaced raw as before, with one new refusal: RFC 5940 sec. 2 states that an
+ *  OCSP response is carried in the `other` arm, so a response placed where a CertificateList belongs
+ *  is a smuggle. It is detected POSITIVELY, by the OCSP module's own response detector, because the
+ *  CRL detector answers false for shapes that are not full CertificateLists and "not a CRL" would
+ *  therefore refuse more than sec. 2 forbids. */
+/** @internal The mapper bound to one walk's ctx, so it fits the one-argument shape a list projection
+ *  passes. The ctx is the walk's own, not a fresh one: that is what carries the caller's caps and the
+ *  budget already being spent into the embedded response. */
+function _mapCrlsWith(ctx, code, what) {
+  var mapper = crlChoiceElement(code, what);
+  return function (item) { return mapper(item, ctx); };
+}
+function crlChoiceElement(code, what) {
+  return function (item, ctx) {
+    var n = item.node;
+    var byClass = CRL_CHOICE_TAGS[n.tagClass];
+    if (!n.constructed || !byClass || byClass[n.tagNumber] !== true) {
+      throw NS.E(code, what + " element tag is outside the closed CHOICE set (RFC 5652 sec. 10.2.1-sec. 10.2.2)");
+    }
+    var out = rawElement(item);
+    if (n.tagClass !== "context") {
+      if (ocspSchema.matchesResponse(n)) {
+        throw NS.E("cms/misplaced-ocsp-response", "an OCSP response is carried in the other [1] " +
+          "RevocationInfoChoice arm under id-ri-ocsp-response, not in the CertificateList arm (RFC 5940 sec. 2)");
+      }
+      return out;
+    }
+    var other = schema.walk(OTHER_REV_INFO, n, ctx).result;
+    out.otherRevInfoFormat = other.otherRevInfoFormat;
+    out.otherRevInfoFormatName = ctx.oid.name(other.otherRevInfoFormat) || null;
+    out.otherRevInfoBytes = other.otherRevInfoNode.bytes;
+    out.ocspResponse = null;
+    if (other.otherRevInfoFormat === OID_ID_RI_OCSP_RESPONSE) {
+      var resp = ocspSchema.walkOcspResponse(other.otherRevInfoNode, ctx);
+      /** @internal RFC 5940 sec. 3: the carried response states a status. A `tryLater` or `malformed`
+       *  OCSPResponse is a VALID OCSPResponse that conveys no revocation information, so it is refused
+       *  HERE rather than in the OCSP module, whose standalone door must keep accepting it. */
+      if (resp.responseStatus.code !== 0) {
+        throw NS.E("cms/bad-ocsp-rev-info", "an id-ri-ocsp-response revocation entry carries a " +
+          resp.responseStatus.name + " OCSP response, which states no revocation status (RFC 5940 sec. 3)");
+      }
+      out.ocspResponse = resp;
+    }
+    return out;
+  };
+}
 CERT_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 CRL_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 function rawChoiceElement(allowed, code, what) {
@@ -648,7 +728,8 @@ var SIGNED_DATA = schema.seq([
     var version = m.fields.version.value;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
     var certificates = m.fields.certificates.present ? m.fields.certificates.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-certificates", "certificates")) : [];
-    var crls = m.fields.crls.present ? m.fields.crls.value.items.map(rawChoiceElement(CRL_CHOICE_TAGS, "cms/bad-crls", "crls")) : [];
+    var crls = m.fields.crls.present
+      ? guard.list.copyMap(m.fields.crls.value.items, _mapCrlsWith(ctx, "cms/bad-crls", "crls")) : [];
     var signerInfos = m.fields.signerInfos.value.items.map(function (it) { return it.value.result; });
 
     if (encapContentInfo.eContentType !== OID_DATA) {
@@ -909,10 +990,16 @@ var ORIGINATOR_INFO = schema.seq([
   schema.optional("crls", schema.implicitSetOf(1, schema.any(), { min: 1, code: "cms/bad-originator-crls", what: "crls" }), { tag: 1 }),
 ], {
   assert: "constructed", code: "cms/bad-originator-info", what: "OriginatorInfo",
-  build: function (m) {
+  /** @internal The build takes `ctx` because the crls mapper decodes the RFC 5940 arm under the
+   *  caller's own caps and budget. This one record is shared by EnvelopedData (RFC 5652 sec. 6.1),
+   *  AuthenticatedData (sec. 9.1) and AuthEnvelopedData (RFC 5083 sec. 2.1), so decoding only in
+   *  SignedData would leave three of the four content types RFC 5940 sec. 1 names undecoded. */
+  build: function (m, ctx) {
     return {
       certs: m.fields.certs.present ? m.fields.certs.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-originator-certs", "OriginatorInfo certs")) : [],
-      crls: m.fields.crls.present ? m.fields.crls.value.items.map(rawChoiceElement(CRL_CHOICE_TAGS, "cms/bad-originator-crls", "OriginatorInfo crls")) : [],
+      crls: m.fields.crls.present
+        ? guard.list.copyMap(m.fields.crls.value.items,
+          _mapCrlsWith(ctx, "cms/bad-originator-crls", "OriginatorInfo crls")) : [],
     };
   },
 });
@@ -1184,7 +1271,14 @@ var CONTENT_INFO = schema.seq([
  * unauthAttrs }` (`aead` holds the validated AES-GCM/CCM nonce + ICV length, or
  * `null` for an unrecognized algorithm). A KEM recipient (RFC 9629) surfaces as
  * `{ type: "ori", oriType, oriValue, kemri }` with the parsed KEMRecipientInfo in
- * `kemri`. Every result additionally carries `contentType` (the dotted OID) and
+ * `kemri`. A `crls` entry is `{ bytes, tagClass, tagNumber }` for a CertificateList;
+ * an entry in the `other [1]` arm additionally carries `otherRevInfoFormat` (dotted),
+ * `otherRevInfoFormatName` (or `null`), `otherRevInfoBytes` (the raw ANY TLV) and,
+ * for RFC 5940 `id-ri-ocsp-response`, `ocspResponse` holding the embedded response
+ * as a record `pki.path.ocspChecker` and `pki.path.verifyOcspResponse` take
+ * directly. A response whose `responseType` is one this build does not decode keeps
+ * its envelope in `ocspResponse` with `basicResponse` null and the body in
+ * `responseBytes.response` as it arrived. `originatorInfo.crls` carries the same shapes. Every result additionally carries `contentType` (the dotted OID) and
  * `contentTypeName` (its registry name) naming which of the five shapes was
  * dispatched. The raw byte ranges an external verifier hashes (`eContent`,
  * `signature`, `signedAttrsBytes`, `authAttrsBytes`, `mac`) are surfaced
@@ -1337,16 +1431,27 @@ function parseCertsOnly(der, E, prefix, maxCerts, requireCert) {
   } else if (allCerts.length === 0 && allCrls.length === 0) {
     throw E(prefix + "/no-certificates", "a certs-only message must contain at least one certificate or CRL (RFC 8551 sec. 3.8)");
   }
+  /** @internal `maxCerts` caps the certificates and CRLs PARSED and RETURNED, which is a resource
+   *  bound. It may not decide which messages are accepted. The tag-class test reads a field off an
+   *  entry the parse already produced and costs nothing, so it runs over EVERY entry before the cap
+   *  is applied: taken after it, a cap leaving no room for the crls dropped a tagged entry silently,
+   *  so a capped reader accepted a message an uncapped reader refuses and handed back an empty crls
+   *  list where revocation information had been. Only the X.509 and CRL parsing below stays bounded,
+   *  which is the work the bound exists for. */
+  for (var ci = 0; ci < allCerts.length; ci++) {
+    if (allCerts[ci].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
+  }
+  for (var cj = 0; cj < allCrls.length; cj++) {
+    if (allCrls[cj].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
+  }
   var certs = (maxCerts != null && allCerts.length > maxCerts) ? allCerts.slice(0, maxCerts) : allCerts;
   for (var i = 0; i < certs.length; i++) {
-    if (certs[i].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
     try { schemaX509.parse(certs[i].bytes); }
     catch (e) { throw E(prefix + "/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
   }
   var crlCap = maxCerts != null ? (maxCerts - certs.length) : null;
   var crls = (crlCap != null && allCrls.length > crlCap) ? allCrls.slice(0, crlCap) : allCrls;
   for (var j = 0; j < crls.length; j++) {
-    if (crls[j].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
     try { schemaCrl.parse(crls[j].bytes); }
     catch (e) { throw E(prefix + "/bad-crl", "a certs-only response carried a non-CRL in its crls field", e); }
   }

package/lib/schema-ocsp.js

@@ -40,6 +40,7 @@ var oid = require("./oid");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
 var _hasOwn = intrinsic.hasOwn;
 var _String = intrinsic.String;
 
@@ -319,18 +320,24 @@ var RESPONSE_BYTES = schema.seq([
   schema.field("response", schema.octetString()),
 ], {
   assert: "sequence", arity: { exact: 2 }, code: "ocsp/bad-response-bytes", what: "ResponseBytes",
+  /** @internal RFC 6960 sec. 4.2.1 dispatches the body on `responseType`, so a type this build does
+   *  not read leaves `basicResponse` null and the body in `response` exactly as it arrived. The
+   *  envelope is the part every reader shares, and which bodies this build decodes is its own support
+   *  limit rather than a shape rule: `parseResponse` refuses an unread body at its door, where the
+   *  caller asked for a response to read, and a response carried inside another structure stays
+   *  readable as far as its envelope goes. A body that claims id-pkix-ocsp-basic is still decoded,
+   *  and still refused when it is not one. */
   build: function (m, ctx) {
     var responseType = m.fields.responseType.value;
     var raw = m.fields.response.value;
-    if (responseType !== OID_OCSP_BASIC) {
-      throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 sec. 4.2.1)");
-    }
     return {
       responseType: responseType,
       responseTypeName: ctx.oid.name(responseType) || null,
       response: raw,
-      basicResponse: schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
-        { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result,
+      basicResponse: responseType === OID_OCSP_BASIC
+        ? schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
+          { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result
+        : null,
     };
   },
 });
@@ -506,7 +513,19 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  *     above it, or an option outside this set, is refused. A parse that exceeds one is
  *     refused with the `/too-large` code of this format.
  */
-var parseResponse = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
+var _parseResponseRecorded = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
+/** @internal The decision is made on `responseType`, the field RFC 6960 sec. 4.2.1 dispatches on,
+ *  rather than on the absent `basicResponse` that follows from it. A non-successful response carries
+ *  no responseBytes at all and keeps reaching the caller, which is the status a live responder
+ *  returns. */
+function parseResponse(input, caps) {
+  var out = _parseResponseRecorded(input, caps);
+  var rb = out.responseBytes;
+  if (rb && rb.responseType !== OID_OCSP_BASIC) {
+    throw NS.E("ocsp/unsupported-response-type", (rb.responseTypeName || rb.responseType) + " is not id-pkix-ocsp-basic (RFC 6960 sec. 4.2.1)");
+  }
+  return out;
+}
 
 /**
  * @primitive  pki.schema.ocsp.pemDecode
@@ -580,9 +599,25 @@ function matchesRequest(root) {
   return true;
 }
 
+/** @internal Walk an ALREADY-DECODED OCSPResponse node under the caller's own parse resources, for a
+ *  carrier that embeds one: RFC 5940 sec. 2 puts an OCSPResponse in a CMS `crls` field, and the CMS
+ *  parse reaches it with a node it has already decoded and a budget it is already spending.
+ *  `parseResponse(bytes)` cannot serve that: it re-decodes from scratch and starts a fresh budget, so
+ *  a caller's tightened caps would not reach the embedded walk. `withResources` carries the caps and
+ *  the budget while keeping this module's own error class, so a malformed embedded response still
+ *  reports an `ocsp/*` code. The record is a recording one, so `guard.parsed.fromTrustedSource`
+ *  accepts it wherever a parsed response is taken and a rebuilt copy is still refused. The re-decode
+ *  this walker performs on raw DER is STRICT, unlike the CMS one: an OCSPResponse has no
+ *  BER-tolerant door. */
+var walkOcspResponse = guard.parsed.recordingWalker("ocspResponse", function (node, ctx) {
+  return schema.walk(OCSP_RESPONSE, node, schema.withResources(NS, ctx)).result;
+  // allow:bare-decode the re-decode a recording walker performs on raw DER a caller hands it, outside any parse.
+}, function (der) { return asn1.decode(der); });
+
 module.exports = {
   parseRequest: parseRequest,
   parseResponse: parseResponse,
+  walkOcspResponse: walkOcspResponse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matchesRequest: matchesRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.56",
+  "version": "0.8.58",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:921f4ed0-ec38-4c9d-b490-d6223c040e96",
+  "serialNumber": "urn:uuid:41653943-4244-48b6-acbe-1493b54bad90",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-06T23:49:00.685Z",
+    "timestamp": "2026-10-07T04:10:13.613Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.56",
+      "bom-ref": "@blamejs/pki@0.8.58",
       "type": "application",
       "name": "pki",
-      "version": "0.8.56",
+      "version": "0.8.58",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.56",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.58",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.56",
+      "ref": "@blamejs/pki@0.8.58",
       "dependsOn": []
     }
   ]